19 December 2015

The Joint Committee on the Draft Investigatory Powers Bill invites any "interested individuals and organisations" to submit evidence to this inquiry. Written evidence should arrive no later than 21 December 2015. Here are the four main questions:

Are the powers sought necessary?

Has the case been made, both for the new powers and for the restated and clarified existing powers?

Are the powers sought legal?

Are the powers compatible with the Human Rights Act and the ECHR? Is the requirement that they be exercised only when necessary and proportionate fully addressed? Are they sufficiently clear and accessible on the face of the draft Bill? Is the legal framework such that CSPs (especially those based abroad) will be persuaded to comply? Are concerns around accessing journalists’, legally privileged and MPs' communications sufficiently addressed?

Are the powers sought workable and carefully defined?

Are the technological definitions accurate and meaningful (e.g. content vs communications data, internet connection records etc.)? Does the draft Bill adequately explain the types of activity that could be undertaken under these powers? Is the wording of the powers sustainable in the light of rapidly evolving technologies and user behaviours? Overall is the Bill future-proofed as it stands?

Are the powers sought sufficiently supervised?

Is the authorisation process appropriate? Will the oversight bodies be able adequately to scrutinise their operation? What ability will Parliament and the public have to check and raise concerns about the use of these powers?

Weirdly, you are not allowed to publish your submission until you are given permission:

Evidence which is accepted by the Committee may be published online at any stage; when it is so published it becomes subject to parliamentary copyright and is protected by parliamentary privilege. Submissions which have been previously published will not be accepted as evidence. Once you have received acknowledgement that the evidence has been accepted you will receive a further email, and at this point you may publicise or publish your evidence yourself. In doing so you must indicate that it was prepared for the Committee, and you should be aware that your publication or re-publication of your evidence may not be protected by parliamentary privilege.

So, let me give a summary of my answers to the questions:

No, the powers are not necessary, because they are based on the idea that mass surveillance works. It doesn't.

No, the powers are not supervised because the "double-lock" authorisation is a sham: the judge does not check whether the authorisation was justified, only whether the procedure was correctly followed.

Also worth noting that the distinction between "content" and "communications data" is meaningless: metadata is actually more revealing than content, because it is already parsed in a computer-readable form that allows it to be combined with billions of other pieces of metadata.

Creating huge databases of metadata will create huge honeypots that will be irresistible to criminals and foreign governments. Stealing the metadata will give them valuable information that can be used for identity theft or blackmail.

Finally, it is worth pointing out that the whole idea of "equipment interference" is really stupid. If agencies are given permission to break into people's systems, they can plant anything there, and make changes to things like browser histories. As a result, any computer evidence in a trial is suspect, since it could easily have been planted using "equipment interference" without anyone noticing. As computer-based evidence becomes more important, "equipment interference" would seriously undermine the UK's legal system. It should be the very rare exception, not part of a standard toolset.

09 December 2015

It seems that there will be a rare UK debate about TTIP tomorrow. This is a great opportunity to contact your MPs and let them know what you think. Here's what I've just sent - you can use WritetoThem to make things easier.

I believe that the
House of Commons will be debating TTIP on Thursday. I hope you are
planning to be there, and might be able to convey some of my concerns
about the proposed agreement.

TTIP is generally
presented as being something that will boost the EU and UK economies,
and provide benefits for all. In fact, the European Commission's own
study shows that even under the most optimistic assumptions, the GDP
gain will only be 119 billion euros. That may sound a lot, but in
fact is only about 0.5% of EU GDP. Moreover, that would be after ten
years of TTIP, so the extra annual GDP in this optimistic scenario is
around 0.05%, which is effectively zero given the uncertainties of
all econometric modelling.

Even that 0.05%
annual GDP boost will probaby be very hard to achieve. According to
the European Commission's own study, it is based on the assumption
that only 20% of the boost will come from removing tariff barriers,
which are already low between the EU and US, while 80% will come from
removing non-tariff barriers (NTBs). But NTBs are essentially
regulations, and are not "trade irritants" as some like to
describe them, but hard-won protections for health, safety, the
environment etc. Removing them would cause huge negative effects on
society – none of which are included in the econometric model. In
fact, *no* costs are included in the CEPR projections, which is
extraordinary.

The European
Commission says that regulations will be harmonised, not lowered.
But that will rarely be possible. For example, for chemicals in
cosmetics, the EU bans 1300 of them, while the US only bans 12. If
it is infeasible to harmonise regulations, and standards will not be
lowered, achieving the 80% of gains will be hard, if not impossible.

Finally, there is
the issue of ISDS. No convincing argument has been offered for why
this is necessary. Both the EU and US have extremely well-developed
legal systems. The European Commission has been unable to cite any
example where an EU company has been discriminated against in the US.
Moreover, the size of the investments across the Atlantic prove that
there is absolutely no problem that needs solving here: the US has
invested 1.5 trillion euros in Europe, while the EU has invested 1.6
trillion euros. Businesses would not be making these massive investments if
there were a problem. And for those that are chary, there is always
investment insurance.

On the other hand,
including ISDS in TTIP will give 19,900 US-based corporations that
own more than 51,400 subsidiaries in the EU the ability to sue the EU
and members states over regulations that they claim will harm their
profits. And while it is true that ISDS cases cannot force
governments to repeal laws, many do since the cost in terms of ISDS
awards are so high: recently, an award of $50 billlion was made
against Russia by an ISDS tribunal. It is clear from past experience that ISDS has a chilling effect on bringing in new laws that protect the public.

I hope these quick
thoughts make clear why I am concerned about TTIP, and believe that
it in its current form it will bring few, if any benefits, to the UK
public, while exposing them and the EU to huge risks. If you have time, which I fear is unlikely, I have written at greater length about TTIP in this extensive feature for Ars Technica UK.

About Me

I have been a technology journalist and consultant for 30 years, covering
the Internet since March 1994, and the free software world since 1995.

One early feature I wrote was for Wired in 1997:
The Greatest OS that (N)ever Was.
My most recent books are Rebel Code: Linux and the Open Source Revolution, and Digital Code of Life: How Bioinformatics is Revolutionizing Science, Medicine and Business.